SDK package safety, ownership, context contracts, and CLI self-description - #880
Conversation
Deliver safe local npm archive installation, deterministic extension command ownership, MCP custom-field collision diagnostics, and universal read-row contracts across CLI and SDK surfaces. Close structured-help contract gaps and align Claude provenance slug resolution across platforms. Add exhaustive focused, integration, packed-consumer, Node, Bun, and exact 100% coverage evidence with PM lineage and generated changelog updates.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Reviewer's GuideImplements secure installation of local npm .tgz/.tar.gz archives, exposes deterministic extension command ownership and MCP custom-field collision diagnostics through SDK and CLI contracts, expands read-row contracts and structured help coverage, fixes Claude provenance slugging, and updates docs, error catalog, tests, and public SDK surface accordingly. Sequence diagram for secure local npm archive installationsequenceDiagram
actor User
participant pm_cli
participant resolveInstallSource
participant extractLocalPackageArchive
participant listTar
participant validateLocalPackageArchiveEntry
participant extractTar
participant installNpmPackageRuntimeDependencies
User->>pm_cli: pm install ./my-package-1.2.3.tgz --project
pm_cli->>resolveInstallSource: resolveInstallSource(source)
resolveInstallSource->>resolveInstallSource: fs.stat(source.absolute_path)
resolveInstallSource->>resolveInstallSource: isLocalPackageArchive(path)
resolveInstallSource->>extractLocalPackageArchive: extractLocalPackageArchive(path)
extractLocalPackageArchive->>extractLocalPackageArchive: fs.stat(archivePath) [size check]
extractLocalPackageArchive->>extractLocalPackageArchive: fs.mkdtemp(...)
extractLocalPackageArchive->>listTar: listTar({ file, onReadEntry })
loop each archive entry
listTar->>validateLocalPackageArchiveEntry: validateLocalPackageArchiveEntry(entry, limits, state)
validateLocalPackageArchiveEntry-->>listTar: ok or throw local_package_archive_unsafe
end
extractLocalPackageArchive->>extractTar: extractTar({ file, cwd })
extractLocalPackageArchive->>extractLocalPackageArchive: fs.readFile(package/package.json)
extractLocalPackageArchive->>installNpmPackageRuntimeDependencies: installNpmPackageRuntimeDependencies(packageRoot)
installNpmPackageRuntimeDependencies-->>extractLocalPackageArchive: dependencies installed
extractLocalPackageArchive-->>resolveInstallSource: { directory, package, version, cleanup }
resolveInstallSource-->>pm_cli: InstallSource with cleanup
pm_cli-->>User: Installed package with verified archive
File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
@greptileai please review the exact current head, including the broad SDK package safety, ownership, custom-field collision, row-contract, structured-help, and provenance changes. |
|
@coderabbitai full review |
Rate Limit Exceeded
|
|
Warning Review limit reached
Next review available in: 38 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (51)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Replace separator-regex normalization with a single-pass scanner and add adversarial 200k-separator coverage in response to CodeQL. Preserve existing MCP collision semantics and exact 100% repository coverage.
|
Review-loop acknowledgement for the current head: Gemini sunset notice acknowledged; Sourcery guide and CodSpeed no-regression report accepted; Sourcery weekly-limit and CodeRabbit review-limit responses marked unhelpful because they produced no findings. The CodeQL finding was fixed and acknowledged inline with exact verification. CodeRabbit reports its next full review is outside this run’s 25-minute review window; I will retry once after the supported wait window while Greptile and hosted checks run. |
|
@greptileai please re-review the current security-fix head. |
|
@coderabbitai full review |
Rate Limit Exceeded
|
|
Exact-head hosted acknowledgement: Codecov confirms every modified line is covered and all tests pass; CodSpeed confirms all 11 benchmarks are unchanged; both are accepted. The second CodeRabbit response was again only a rate-limit notice and is marked unhelpful. All hosted checks now pass, CodeQL is resolved/outdated with its inline fix reply, and there are zero unresolved review threads. |
|
Review availability limitation: the repository Greptile gate reached |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
CodeRabbit final review acknowledgement: the explicit post-fix review completed on exact head |
2 participants
Summary
This broad SDK/CLI tranche strengthens pm as a universal context-management platform across package authoring, customization safety, composable reads, and self-describing runtime contracts.
.tgz/.tar.gzarchives with strict package layout, path/link, entry-count, archive-size, expanded-size, and per-entry boundslast_activated_winspolicy through CLI and SDKhelpitselfpm-changelogextension and generated changelogPM lineage
--fieldsVerification
npx, Bun install, andbunxCloses #844
Closes #878
Closes #879
Summary by Sourcery
Strengthen SDK and CLI contracts around local package installation, command ownership, MCP custom-field safety, read-row projections, structured help coverage, and provenance reporting.
New Features:
Bug Fixes:
Enhancements:
Build:
Documentation:
Tests:
Summary by cubic
Adds safe local npm archive installs, deterministic extension command ownership, MCP custom‑field collision diagnostics, universal read‑row contracts, and full structured‑help resolution across CLI and SDK. Hardens custom‑field normalization to linear time and fixes Claude session slug encoding so model/version provenance is recorded.
New Features
.tgz/.tar.gzwith strict bounds (archive, entries, expanded size, per‑entry); preserves provenance; new error codelocal_package_archive_unsafe(usestar@7.5.22).last_activated_winspolicy; included in SDKdescriberesults.PM_TOOL_RESERVED_CUSTOM_FIELD_PROPERTIESandresolvePmToolCustomFieldCollision; new lint codefield_mcp_input_collision.comments,notes,learnings), linked resources (files,docs), validation, and contracts; outputs includerow_contract; exportsPM_READ_ROW_CONTRACTS.help.Bug Fixes
Written for commit 48bf0a0. Summary will update on new commits.